AZ-802 Secure Windows Server Infrastructure — Timed 15 Questions

Question 1

You are configuring BitLocker Network Unlock for a cluster of Windows Server 2022 nodes. The servers are equipped with TPM 2.0 and are connected to a wired network. You have already installed the BitLocker Network Unlock feature on a Windows Deployment Services (WDS) server. What is the next requirement to ensure that the servers automatically unlock their OS drives upon rebooting while connected to the internal network?

15 minute time limit — choose an answer to begin.

Accepted Answer

The client servers must be configured to use DHCP and have a UEFI firmware.. While UEFI and TPM are required, the critical missing piece for Network Unlock to function is that the client must be configured to use DHCP. The WDS server provides the unlock key via a DHCP-based protocol. Additionally, the explanation should clarify that the client must be connected to the same subnet as the WDS server or have a DHCP helper configured to forward the requests.

Answer

The client servers must have the BitLocker Drive Encryption feature disabled during the initial sync.

Answer

The WDS server must be running in 'Transport Server' mode only with no images.

Answer

The client servers must be joined to an Azure Active Directory domain specifically.

Question 2

To monitor for unauthorized access to sensitive files on a Windows Server 2022 file server, you decide to enable auditing. Which category of the Advanced Audit Policy must be configured to track when a user successfully opens a file on a monitored share?

Accepted Answer

Object Access. Object Access auditing is used to track access to specific objects on a Windows system, such as files, folders, and registry keys. To track file access, you must enable the 'Audit File System' subcategory under 'Object Access' and then configure the System Access Control List (SACL) on the specific files or folders.

Answer

Account Logon

Answer

Privilege Use

Answer

Policy Change

Question 3

You are hardening a Windows Server 2022 instance. You need to implement Credential Guard to protect NTLM and Kerberos credentials from memory-based attacks. Which prerequisite must be met on the server?

Accepted Answer

Ensure the hardware supports Second Level Address Translation (SLAT).. Credential Guard requires Virtualization-Based Security (VBS). The core hardware prerequisites are UEFI with Secure Boot, and CPU support for virtualization extensions (Intel VT-x or AMD-V) and Second Level Address Translation (SLAT). While SLAT is a correct prerequisite, the explanation should explicitly mention that VBS/Hyper-V hypervisor support is the underlying requirement.

Answer

Enable the Remote Desktop Protocol (RDP) Restricted Admin mode.

Answer

Install the Windows Defender Application Guard feature.

Answer

Disable the Windows Update service.

Question 4

You want to prevent the usage of weak encryption protocols, specifically SSL 3.0 and TLS 1.0, on your Windows Server. How should you proceed?

Accepted Answer

Modify the registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.. Modifying the registry under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols is the standard method for disabling legacy SSL/TLS versions in Windows Server. The explanation correctly identifies this but should explicitly mention that creating 'Enabled' and 'DisabledByDefault' DWORD values under the specific protocol subkeys is the required action.

Answer

Run the 'Set-SmbServerConfiguration' cmdlet with the -DisableOldProtocols switch.

Answer

Update the Windows Firewall rules to block port 443.

Answer

Use the Local Security Policy snap-in to change the 'Minimum Password Length' setting.

Question 5

You are hardening your server's disk security. You need to ensure that data at rest is encrypted. Which feature should you enable?

Accepted Answer

BitLocker Drive Encryption.. BitLocker Drive Encryption provides full-volume encryption, protecting data from unauthorized access if physical drives are stolen or if an attacker gains unauthorized access to the underlying storage. This is a foundational security control for protecting data at rest in Windows environments. By using a Trusted Platform Module (TPM) to manage keys, you ensure that the drive can only be decrypted when the server is in a known, trusted boot state.

Answer

Encrypted File System (EFS).

Answer

NTFS Permissions.

Answer

Windows Defender Antivirus.

Question 6

Your organization implements Just Enough Administration (JEA) to manage Windows Servers. A junior administrator needs to restart the Print Spooler service on several print servers but should not have full administrative rights. You need to identify the specific file that defines which cmdlets and external commands the junior administrator can execute. Which file should you configure?

Accepted Answer

The Role Capability file (.psrc). The Role Capability file defines exactly which cmdlets, functions, and external commands a user is allowed to run when connecting to a JEA endpoint. By restricting access to only the necessary tools for a specific task, you minimize the potential for lateral movement or accidental misconfiguration. This principle of least privilege is a cornerstone of securing administrative access in modern Windows Server environments.

Answer

The Session Configuration file (.pssc)

Answer

The PowerShell Profile file (.ps1)

Answer

The Module Manifest file (.psd1)

Question 7

An administrator is concerned about man-in-the-middle attacks where an attacker intercepts and modifies SMB traffic between a Windows Server 2022 file server and its clients. Which security feature should be enforced to ensure the integrity and authenticity of the SMB traffic?

Accepted Answer

SMB Signing. SMB Signing is a security mechanism in the SMB protocol that allows for the digital signing of SMB packets. This prevents the modification of data in transit and protects against man-in-the-middle attacks. Enforcing this feature ensures that both the client and the server can verify the origin and integrity of every packet exchanged during a session.

Answer

NTFS Permissions

Answer

Access-Based Enumeration

Answer

Disk Quotas

Question 8

Your company is implementing a Tiered Administration Model to secure its Windows Server infrastructure. You need to deploy Privileged Access Workstations (PAWs) for all Domain Admins. What is the primary purpose of using a PAW in this environment?

Accepted Answer

To provide a dedicated environment that is isolated from the risks of email and web browsing.. A Privileged Access Workstation (PAW) provides a dedicated, hardened environment for sensitive administrative tasks. By isolating high-privilege credentials from common threats like email, web browsing, and general-purpose applications, PAWs significantly reduce the risk of credential theft. This isolation is a critical defense-in-depth strategy for protecting high-value accounts in an Active Directory forest.

Answer

To allow administrators to browse the internet safely while performing server updates.

Answer

To enable multiple users to share a single high-privilege account across the organization.

Answer

To automatically synchronize local administrator passwords across all domain controllers.

Question 9

You are configuring Windows Defender Credential Guard on a fleet of Windows Server 2022 Hyper-V hosts. You want to protect the LSA process from being accessed by unauthorized users or malware. Which hardware-based security feature must be enabled in the BIOS/UEFI and supported by the CPU for Credential Guard to operate?

Accepted Answer

Virtualization Extensions (Intel VT-x or AMD-V) and SLAT. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, in a protected environment. This requires hardware support for virtualization and Second Level Address Translation (SLAT) to create the secure memory enclave that the Local Security Authority (LSA) uses to shield credentials.

Answer

Direct Memory Access (DMA) Protection

Answer

Hyper-Threading Technology

Answer

Hardware-enforced Stack Protection

Question 10

You are planning the deployment of Shielded Virtual Machines in a Windows Server 2022 environment. You need to ensure that the Fabric Administrators cannot access the data within the VMs. Which component of the Host Guardian Service (HGS) is responsible for verifying that a Hyper-V host is authorized to run a Shielded VM?

Accepted Answer

The Attestation Service. The Host Guardian Service (HGS) is the central authority for Shielded VMs. The Attestation Service within HGS evaluates the health and identity of the Hyper-V host. If the host passes attestation, the HGS Key Protection Service then provides the keys necessary to start or migrate the Shielded VM, ensuring it only runs on trusted hardware.

Answer

The Key Protection Service

Answer

The Virtualization-based Security (VBS) engine

Answer

The TPM 2.0 Emulator

Question 11

You manage a Windows Server Update Services (WSUS) infrastructure with one upstream server and three downstream servers. You want the downstream servers to only download updates that have been approved on the upstream server. Which WSUS configuration mode should you use for the downstream servers?

Accepted Answer

Replica mode. WSUS supports two modes for downstream servers: Replica and Autonomous. In Replica mode, the downstream server mirrors the update approvals, settings, and classes of the upstream server. This centralizes management and ensures that only updates vetted and approved by the central administrator are distributed across the entire organization's branch offices or departments.

Answer

Autonomous mode

Answer

Distributed mode

Answer

Disconnected mode

Question 12

You are using Azure Update Management to manage updates for both on-premises Windows Servers and Azure VMs. You need to ensure that a specific group of on-premises servers never receives a particular update that is known to cause application compatibility issues. How should you configure this in Azure Update Management?

Accepted Answer

Create an 'Excluded updates' list in the Update Deployment configuration.. Azure Update Management allows for granular control over update deployments through deployment schedules. When creating a deployment, you can specify excluded updates by their Knowledge Base (KB) ID. This ensures that even if an update is critical or security-related, it will not be installed on the targeted machines, preventing known compatibility problems.

Answer

Modify the local Registry on each server to block the KB ID.

Answer

Use a Group Policy Object (GPO) to disable the Windows Update service.

Answer

Uninstall the Log Analytics agent from the affected servers.

Question 13

You need to create a Group Managed Service Account (gMSA) for a new web application cluster running on Windows Server 2022. Which TWO prerequisites must be met before you can successfully create and use the gMSA in your Active Directory domain? (Select TWO)

Accepted Answer

The Active Directory schema must be updated to at least Windows Server 2012.. Creating a gMSA requires a specific environment setup. First, the Active Directory schema must be at least Windows Server 2012. Second, the Key Distribution Service (KDS) Root Key must be created to allow domain controllers to generate the passwords. These steps ensure that the automated password management system has the necessary foundation to operate.

Answer

Every server in the cluster must be running the Windows Insider preview build.

Answer

The Domain Functional Level must be set to Windows Server 2022.

Answer

An Azure AD Connect instance must be active and syncing to the cloud.

Question 14

You are configuring Azure Bastion to provide secure RDP access to your Windows Server VMs in an Azure Virtual Network. Which THREE requirements must be met for a successful deployment? (Select THREE)

Accepted Answer

A subnet named 'AzureBastionSubnet' must exist in the Virtual Network.. Azure Bastion is a managed PaaS service that provides secure RDP and SSH access. It requires a dedicated subnet named 'AzureBastionSubnet' with a minimum mask of /26. Additionally, it requires a Public IP address for the Bastion resource itself. This setup ensures that your VMs do not need public IP addresses for administrative access.

Answer

All target Windows Servers must have the Remote Desktop Gateway role installed.

Answer

A Site-to-Site VPN must be established between Azure and on-premises.

Question 15

You are securing Windows Admin Center (WAC) to manage your Windows Server 2022 environment. You want to implement granular access control for different IT teams. Which TWO methods can be used to control who has access to Windows Admin Center and what they can do? (Select TWO)

Accepted Answer

Active Directory groups for gateway access control.. Windows Admin Center security is managed through two main layers: gateway access and tool access. Gateway access is controlled via local groups or Active Directory groups on the WAC server. For more granular control over specific server tasks, WAC integrates with Just Enough Administration (JEA) to limit the cmdlets and actions available to the user.

Answer

Azure Key Vault for storing the WAC login credentials.

Answer

NTFS permissions on the Windows Admin Center installation folder.

Answer

DHCP Reservations for the WAC gateway IP address.